Rust project: ongoing video-call / fake audio-codec campaign targeting rust-lang members and popular crate owners
The crates.io team and Rust security response working group (blog.rust-lang.org; 17 September 2026) warn of an ongoing social-engineering campaign against rust-lang members and owners of popular crates aimed at compromising developer devices and accounts to publish malware. Lure: positive-sounding video calls (job / project / contract), then pressure to install a “missing audio codec” or run a clipboard-pasted command. Attackers stand up new but plausible company profiles including LinkedIn pages to pass cursory checks. Linked prior activity: similar targeting of prominent Rust developers in June 2026, and the brief August 2026 compromise of the arrayref crate via similar attacks (SecurityWeek previously tied arrayref to North Korean operators). The project notes the style is known DPRK tradecraft and has been seen outside the Rust community, without naming a specific actor for the current wave. Guidance: be suspicious of cold outreach; prefer calls on platforms you already trust (ideally self-scheduled); re-check MFA and unexpected logins; contact help@crates.io / security@rust-lang.org if concerned. Amplify: SecurityWeek 21 September 2026. No CVE.
- Product
- Rust / crates.io maintainer accounts and developer workstations (supply-chain publish path)
- Versions
- n/a (social engineering / account takeover; prior arrayref compromise Aug 2026)
- Exploited in Australia?
- unknown
- Patch to
- Maintainers: refuse unsolicited codec installs and clipboard-run commands from cold video calls; self-host calls on known platforms; verify MFA and session history on crates.io/GitHub; rotate tokens if any doubt; consumers: pin/verify crate owners and watch for unexpected crate releases from high-traffic packages (arrayref-class incidents).
Primary: Rust Blog — Be alert: targeted attacks on prominent Rustaceans (17 Sep 2026) · Vendor: crates.io / Rust security response working group primary alert · SecurityWeek — Rust team / crate owners video-call campaign amplify (21 Sep 2026)